cerberus | bff4c1097f87aac75d64430f93e4df4e4225ab776be31f58080cb58d00325e55

General

Target

db6c6bdda89349f8de2be84ed4373c18.apk
Size

3.4MB
MD5

db6c6bdda89349f8de2be84ed4373c18
SHA1

ba6d9778332737c9750e72c98e29e73c932422d8
SHA256

bff4c1097f87aac75d64430f93e4df4e4225ab776be31f58080cb58d00325e55
SHA512

2cbcc56ae5493d44474584c9f95531639a718a6296b535c6aebe3a05f06b9e6423a0c501b2c3aa9b2dbfaf5f56167b7b481ca7fcde5d7f7697af5c7ebefc163f
SSDEEP

98304:oK5IxjqynCxNbPgx8ci4fVNGz0MFyclyMu2:oK5mqyCxNQ8cFfVNoyK

Score

10^/10

cerberus banker collection evasion infostealer rat stealth trojan

Malware Config

Extracted

Family

cerberus

C2

http://samadeveloper.com/

Signatures

Cerberus
An Android banker that is being rented to actors beginning in 2019.
banker trojan infostealer evasion rat cerberus

Makes use of the framework's Accessibility service 2 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion

Input Injection

T1516

Screen Capture

T1513

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	grocery.drink.custom
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	grocery.drink.custom

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4274	grocery.drink.custom

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/grocery.drink.custom/app_DynamicOptDex/nS.json	4274	grocery.drink.custom
/data/user/0/grocery.drink.custom/app_DynamicOptDex/nS.json	4299	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/grocery.drink.custom/app_DynamicOptDex/nS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/grocery.drink.custom/app_DynamicOptDex/oat/x86/nS.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/grocery.drink.custom/app_DynamicOptDex/nS.json	4274	grocery.drink.custom

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 IoCs

evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	grocery.drink.custom

Listens for changes in the sensor environment (might be used to detect emulation) 1 IoCs

evasion

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	grocery.drink.custom

grocery.drink.custom
1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4274
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/grocery.drink.custom/app_DynamicOptDex/nS.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/grocery.drink.custom/app_DynamicOptDex/oat/x86/nS.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4299

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

Input Injection

Credential Access

Discovery

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/grocery.drink.custom/app_DynamicOptDex/nS.json

Filesize
740KB

MD5
9c17f35d46b49ef28821db5ed9f41a4c

SHA1
d43410906eacef6a9d378f602a238c3411a31c75

SHA256
b4e8b230848f4e07bc159f33575511b50de296bbfd47ee5ccee4bf2354c04337

SHA512
bf48dfe0c9b85423a84c7c071ea21abe0d724ae39cdc8d20c162d78e3fa58deff71acca16999bc7db87235cb8d4d00b33f72efd924e02dd7eb608a1ecd358786

Download Submit
/data/data/grocery.drink.custom/app_DynamicOptDex/nS.json

Filesize
740KB

MD5
cedc99833d0a80593ee3e2235daa9951

SHA1
cee1736fb56133a6c1ed5b370c9997b2564280b1

SHA256
54aa5e7e026ded064757331ff965f6d3d3d3d7cf206f457df6a9612cbce2d51e

SHA512
5be6771618acc72a6458210b7a00012335bd17814989858bf8f935013623c9ad7b35438f5ecf94f01d74429011f1619c231a79f6101321d3b763876ce1ce5f9e

Download Submit
/data/data/grocery.drink.custom/app_DynamicOptDex/oat/nS.json.cur.prof

Filesize
894B

MD5
0186068481ec78a95920f4f6eef73562

SHA1
58a36785cb1ecf63cfcf9c696ee91a7a9a0fe240

SHA256
d330d92ea2fb4142353d7bcb92e0caec98a7e09c3a5bd0da42584b793659066b

SHA512
8831d7f2c834050d9ebc45955f39c5adcf8288fa2e354cf6b8734f8d585a776926883f79aab59f2e97d2a849dd81531bb983e5850995545ecbef472f5ab4ef21

Download Submit
/data/user/0/grocery.drink.custom/app_DynamicOptDex/nS.json

Filesize
740KB

MD5
dd0411767b7807abe4c2c5244b23eed3

SHA1
db1097bce804d0fef132c89f3bb662572fe77882

SHA256
8f4842d48f92e8605d9719ac79493ae8ab00ff646816ba35602d6a190b3d4577

SHA512
0631389c385cf1d93b1768a482bc093e57b2259bfbb7076d6afa21f9168996a712be01c63a34a0604b7f6c22ee567e91cf46108005f3db5040d2c8f680c22a75

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads